CVE-2026-22665 is a CWE-178 vulnerability in prompts.chat where inconsistent case-sensitive and case-insensitive processing of usernames across write and read operations enables identity confusion. Attackers can create case-variant usernames that circumvent uniqueness enforcement, resulting in non-deterministic username resolution. This can be exploited to impersonate victim accounts, overwrite profile content on canonical URLs, and inject malicious metadata and content platform-wide. The vulnerability affects all versions prior to commit 1464475 and has a CVSS 4.0 score of 8.6 (high severity). There is no vendor advisory or patch information available at this time.

The vulnerability allows attackers to bypass username uniqueness checks by exploiting inconsistent case handling, leading to identity confusion. This can result in impersonation of legitimate users, unauthorized modification of profile content, and injection of attacker-controlled data across the platform. Such impacts compromise user trust and platform integrity. There are no known exploits in the wild currently.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users and administrators should monitor for updates from the vendor and consider implementing manual controls or restrictions on username case variants if feasible.